Methodology
Tested automatically. Released by people.
Our audits are automated and AI-driven. One agent maps your application and hands the work to specialised agents. They test in parallel and check each other. At the end, a quality gate lets only proven findings through.
- OWASP Top 10:2025
- OWASP API Top 10
- OWASP ASVS
- CVSS 3.1
- CWE
- CVE
- OSV
- NIS2 & CRA
From order to report
Many agents. One quality gate.
You provide the approval and the access. Everything in between runs automated and in parallel.
- Orderapproval and accessYour input
- Scan agentmaps and assigns
- Agents in parallelreview each other
- Quality gatechallenge, CVSS
- Reportwith action plan
- Your fixesre-check on requestYour input
What happens in each step
- 01
Map the attack surface
The scan agent reads your application: endpoints, roles, data flows, dependencies, build and configuration. This becomes the map for every further step.
- 02
Assign the work
The same agent orchestrates. Each area gets a specialised agent, for example for access rights, injection, secrets or dependencies.
- 03
Test in parallel
Tools such as semgrep, gitleaks, osv-scanner, trivy, ZAP and nuclei produce signals. The agents read the context and turn them into candidate findings.
- 04
Review each other
An independent agent tries to refute every candidate. It only sees the finding and its location, not the finder’s reasoning.
- 05
Quality gate
Only proven findings pass: deduplicated, rated with CVSS 3.1, mapped to CWE and OWASP.
- 06
Report
Management summary, every finding with location and recommendation, action plan by priority. Delivered encrypted.
The quality gate
A finding only makes it into the report if it passes every one of these checks. That is how thousands of signals become a few solid findings.
- Proven in the code or in the running application
- Not refuted by a second agent
- No duplicate, no test code, no dead path
- Rated with CVSS 3.1, mapped to CWE and OWASP
- With a concrete recommendation for the fix
- In the Full Audit, also released by an expert
What the AI may and may not do
- The AI provider does not train on your code
- Read-only: we do not run your code and push nothing
- Active tests only with your approval by email
- No finding without proof
- We release the report, not the model
Based on common standards
We rate and name findings the way your team, your customers and auditors know them. The report does not replace a certification.
- OWASP Top 10:2025The ten most critical risks for web applications.
- OWASP API Top 10The most common risks in APIs and backends.
- OWASP ASVSVerification requirements for login, sessions and access.
- CVSS 3.1Severity of every finding from 0 to 10.
- CWEThe weakness class behind every finding.
- CVEKnown vulnerabilities in your dependencies.
- OSVVulnerabilities in open-source packages.
- NIS2 & CRAThe report as proof for regulators and customers.
What each kind of access sees
With access to the application, we test what an attacker can do. With access to the code, we see why. Together, they give the complete picture.
| Check | App only | Code only | Both | |
|---|---|---|---|---|
| TLS, headers, cookies, CORS | complete | complete | partial | complete |
| Exposed endpoints, admin & debug pages | partial | complete | partial | complete |
| Login, sessions, rate limits | no | good | good | proven |
| Access: can user A see user B’s data? | no | proven | partial | proven |
| Injection (SQL, XSS, SSRF) | no | partial | good | proven |
| Secrets & keys | partial | partial | complete | complete |
| Dependencies & known CVEs | partial | partial | complete | complete |
| Supply chain, Docker, CI/CD | no | no | complete | complete |
| Code quality & best practices | no | no | complete | complete |
All packages compared
| Security checkfree | App audit€490 | Code audit€890 | Full audit€1,690 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | included | included | partly | included | included |
| Login, sessions, rate limits | not included | included | included | included | included |
| Access rights: can user A see user B’s data? | not included | included | partly | included | included |
| Injection (SQL, XSS, SSRF) | not included | partly | included | included | included |
| Secrets and keys | partly | partly | included | included | included |
| Supply chain, Docker, CI/CD | not included | not included | included | included | included |
| What you get | |||||
| Grade and number of findings | included | included | included | included | included |
| Report with a prioritised action plan | not included | included | included | included | included |
| CVSS 3.1 ratings | not included | included | included | included | included |
| Debrief and re-check | not included | not included | not included | included | included |
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | usually within 2 hours on working days | 1 working day | 2 working days | 4 working days | individual |
What we do not do: no manual penetration tests and no load or performance tests. We audit automatically with AI support, and every finding is backed by its location. The report states what was out of scope.